云主机云服务器

美国VPS修复跨域资源共享漏洞的方法

修复代码如下：

public class RefererFilter implements Filter {

private static Logger logger = LoggerFactory.getLogger(RefererFilter.class);

private final String ORIGIN = "Origin";

private final String REFERER = "referer";

/** 允许访问的域名列表 */

private List allowDomainList = new ArrayList<>();

/** 过滤器忽略处理的url规则 */

private List excludes = new ArrayList<>();

@Override

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)

throws IOException, ServletException {

if (logger.isDebugEnabled()) {

logger.debug("referer filter is open");

}

// 判断该url是否需要过滤

HttpServletRequest req = (HttpServletRequest) request;

HttpServletResponse resp = (HttpServletResponse) response;

if (handleExcludeURL(req, resp)) {

chain.doFilter(request, response);

return;

}

if (null != allowDomainList && !allowDomainList.isEmpty()) {

logger.info("referer过滤");

String origin = req.getHeader(ORIGIN);

// 获取referer域

String referer = getRefererDomain(req.getHeader(REFERER));

logger.info("origin={}, referer={}", origin, referer);

if (origin == null || (allowDomainList.contains(origin) && (allowDomainList.contains(referer)))) {

// 有值，就继续执行下一个过滤链

chain.doFilter(request, response);

} else {

// 服务器拒绝

resp.setStatus(HttpStatus.FORBIDDEN.value());

}

} else {

chain.doFilter(request, response);

}

}

@Override

public void init(FilterConfig filterConfig) throws ServletException {

if (logger.isDebugEnabled()) {

logger.debug("referer filter init ====================");

}

String excludesTemp = filterConfig.getInitParameter("excludes");

if (excludesTemp != null) {

String[] url = excludesTemp.split(",");

for (int i = 0; url != null && i < url.length; i++) {

excludes.add(url[i]);

}

}

logger.info("excludes={}", excludes);

String allowDomainListTemp = filterConfig.getInitParameter("allowDomainList");

if (allowDomainListTemp != null) {

String[] url = allowDomainListTemp.split(",");

for (int i = 0; url != null && i < url.length; i++) {

allowDomainList.add(url[i]);

}

}

logger.info("allowDomainList={}", allowDomainList);

}

/**

* @param request

* @param response

* @return

*/

private boolean handleExcludeURL(HttpServletRequest request, HttpServletResponse response) {

if (excludes == null || excludes.isEmpty()) {

return false;

}

String url = request.getServletPath();

logger.info("校验{}是否需要referer过滤。", url);

for (String pattern : excludes) {

Pattern p = Pattern.compile("^" + pattern);

Matcher m = p.matcher(url);

if (m.find()) {

return true;

}

}

return false;

}

/**

* 获取referer域名

*

* @param refererUrl

* @return

*/

private static String getRefererDomain(String referer) {

String result = referer;

if (StringUtils.isNotBlank(referer)) {

if (referer.startsWith("https://")) {

int i = referer.substring(8).indexOf("/");

if (i > 0) {

result = referer.substring(0, 8 + i);

}

} else if (referer.startsWith("http://")) {

int i = referer.substring(7).indexOf("/");

if (i > 0) {

result = referer.substring(0, 7 + i);

}

}

}

return result;

}

}

购买使用一诺网络美国VPS，可以极大降低初创企业、中小企业以及个人开发者等用户群体的整体IT使用成本，无需亲自搭建基础设施、简化了运维和管理的日常工作量，使用户能够更专注于自身的业务发展和创新。美国VPS低至49元/月，购买链接：https://www.enuoidc.com/vpszq.html ?typeid=3